hasura / hasura/graphql-engine

Queries do not fallback to unauthorized user role if custom defined auth cookie header is not present

Open
#7,620 2 comments 5 reactions 0 assignees View on GitHub
k/bug
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version: v2.0.8.cloud-3

### Environment

Cloud

### What is the expected behaviour?

If a cookie header is identified in HASURA_GRAPHQL_JWT_SECRET, but not provided in a request, it should assume any anonymous defined role.

### Keywords
header, cookie, jwt

### What is the current behaviour?

Server error that the cookie was not found.

### How to reproduce the issue?

1. Define `HASURA_GRAPHQL_JWT_SECRET` with an optional header type of cookie and a custom name.
2. Define an anonymous role
3. Make a query without. the specified cookie.

### Screenshots or Screencast

### Please provide any traces or logs that could help here.

### Any possible solutions?

### Can you identify the location in the source code where the problem exists?

### If the bug is confirmed, would you be willing to submit a PR?

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the request described with a custom cookie header in HASURA_GRAPHQL_JWT_SECRET, an anonymous role, and no cookie. Trace the JWT authentication handling to find why a missing cookie is treated as an error; done means the request falls back to the configured anonymous role without that error, with regression coverage for the scenario.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, typescript
Domain
api, authentication, authorization, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.